Zonal Safety Analysis

ARP4761A Zonal Safety Analysis (systems-engineering-safety/arp4761a/zonal-safety-analysis)

Use when the task is the zonal safety analysis (ZSA) per ARP4761A: zone identification, hazard severity classification, separation and containment assessment, zonal hazard checklist completeness, and the ZSA report that rolls the findings up for the safety assessment.

Domain quick reference

• ZSA is one of the three common cause analyses in ARP4761A, next to particular risk analysis (PRA) and common mode analysis (CMA). It examines each physical zone of the aircraft: the components installed in the zone, the structure, the wiring, the plumbing, and the external threats that can enter the zone such as fire, fluid leaks, and impacts.
• Severity classes follow the ARP4761A ladder: minor (rank 1), major (2), hazardous (3), catastrophic (4). A zone with findings ['minor', 'major', 'hazardous'] rolls up to 'hazardous' (the highest severity present); an empty finding list rolls up to 'none'.
• The zonal hazard checklist must be fully assessed before the zone can be accepted: 9 of 12 items assessed is 0.75 coverage and not complete; 12 of 12 is 1.0 and complete.
• Separation verdict: measured clearance at least the required gap is 'ok' (50.0 mm against 50.0 mm required), any shortfall is 'action' (49.0 against 50.0).
• Containment verdict: barrier rating at least the hazard energy is 'ok' (rating 3 against energy 2), otherwise 'action' (rating 2 against energy 3).
• Report rollup (verified by the contract test): three zones with assessed/total 10/10, 8/10, 6/6 and severity rollups major, hazardous, none give total_zones 3, action_zones ['142', '143'], checklist coverage 24/26 (about 0.923), and verdict 'action'.

Workflow

1. Identify the physical zones of the aircraft and the components in each zone (zone_identification in the logic module).
2. Classify the hazards in each zone by severity with severity_rank and zone_severity_rollup.
3. Assess separation between the zone components and the hazard sources with separation_verdict, and containment of the sources with containment_verdict.
4. Check the zonal hazard checklist completeness with checklist_coverage and checklist_complete.
5. Produce the ZSA report with zsa_report and gate the safety assessment on the zone verdicts and the checklist coverage.

Pitfalls

• Confusing ZSA with the ARP4761A safety-assessment skill: severity here is categorized per physical zone content and external threats, not per failure condition in the FHA/PSSA/SSA sequence.
• Confusing ZSA with the whole common-cause-analysis skill: CCA covers ZSA, PRA, and CMA; a zonal pass list alone is not a completed common cause analysis.
• Rating the zone findings without the severity classification, so the rollup and the report verdict lose their basis.
• Forgetting the external threats that enter the zone (fire, fluid leaks, impacts) and assessing only the components inside it.
• Accepting a zone while checklist items remain unassessed (coverage below 1.0); an incomplete checklist is an open finding.
• Treating separation or containment as absolute when the verdict is 'action' and the zone still needs mitigation before acceptance.
• Double counting a hazard already covered by the fault tree or the particular risk analysis without a cross-reference in the report.
• Reusing a zone definition across programs without re-identifying the zones, since zone boundaries depend on the installed configuration.

Behavior contract (gate 3)

The severity classification, rollup, checklist coverage and completeness, separation and containment verdicts, and report rollup logic is exercised by the gate 3 contract test: scripts/test_zonal_safety_analysis.py against scripts/zonal_safety_analysis_logic.py (stdlib unittest, offline). Run: python3 scripts/test_zonal_safety_analysis.py

Compliance

• Standards referenced, not reproduced: ARP4761A text is proprietary (SAE); summary-only per standards-map.yaml and brief 06.
• compliance: STANDARDS-REF, gated: false.